Missing Bounds Check in lib0 Allows Memory Disclosure
CVE-2026-102360
8.6HIGH
What is CVE-2026-102360?
A significant vulnerability exists in lib0 where a missing bounds check in the binary decoder allows unauthorized remote peers to access adjacent process memory. This flaw arises from the readUint8Array function, which fails to validate the length of input data against the decoder's memory view. Consequently, an attacker capable of sending bytes to the lib0 decoder can manipulate the system to expose sensitive data, such as document contents, personal information, and session tokens, compromising the security of the host process. The issue has been addressed in versions 0.2.118 and 1.0.0-rc.33.
Affected Version(s)
lib0 <= 0.2.1-0.2.117 <= 0.2.1-0.2.117
lib0 <= 1.0.0-rc.32 <= 1.0.0-rc.32